lumma | e80e120da34729c9fb7e7d4a684a7260f1346696ee8b3b514b6e512ebfa1bea4

Analysis

max time kernel
97s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 216KB
Sample240909-q89e2a1gpl
SHA256 e80e120da34729c9fb7e7d4a684a7260f1346696ee8b3b514b6e512ebfa1bea4
MD5 69f26c9e7dfc93644c1c9ebaeff84128
SHA1 c02eea30ec044a3e8f60b84b960ed70bbf7fee2e
SHA512 9b95a0c2a92b0cd4c5e866cf3f4c36b0b72faceb1a7af75da8ae7b39d75c100e1de47b106db0e594671c543606fc9db62eca293ccbe068b4e5f67859bb14a533
SSDEEP 6144:SRVDJEiSbWAUzJYyFhMNFM0ncnWIIHMEO:MJSbWAUzJHFqrM0nMWIpEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealc vidar default credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

vidar

https://t.me/fneogr
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

https://charistmatwio.shop/api
https://preachstrwnwjw.shop/api
https://complainnykso.shop/api
https://basedsymsotp.shop/api
https://grassemenwji.shop/api
https://ignoracndwko.shop/api
https://stitchmiscpaew.shop/api
https://commisionipwn.shop/api
https://tenntysjuxmz.shop/api

Signatures

Detect Vidar Stealer 10 IoCs

stealer

resource	yara_rule
behavioral2/memory/3376-90-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-93-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-99-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-125-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-126-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-127-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-143-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-159-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-166-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/3376-167-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 2 IoCs

pid	Process
3848	AdminHJDGCGDBGC.exe
4936	AdminDHIDHIEGII.exe

Loads dropped DLL 2 IoCs

pid	Process
3948	RegAsm.exe
3948	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 3948	2340	file.exe	88
PID 3848 set thread context of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 4936 set thread context of 3344	4936	AdminDHIDHIEGII.exe	105

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminHJDGCGDBGC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminDHIDHIEGII.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3948	RegAsm.exe
3948	RegAsm.exe
3948	RegAsm.exe
3948	RegAsm.exe
3376	RegAsm.exe
3376	RegAsm.exe
3376	RegAsm.exe
3376	RegAsm.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 636	2340	file.exe	87
PID 2340 wrote to memory of 636	2340	file.exe	87
PID 2340 wrote to memory of 636	2340	file.exe	87
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 2340 wrote to memory of 3948	2340	file.exe	88
PID 3948 wrote to memory of 1580	3948	RegAsm.exe	93
PID 3948 wrote to memory of 1580	3948	RegAsm.exe	93
PID 3948 wrote to memory of 1580	3948	RegAsm.exe	93
PID 1580 wrote to memory of 3848	1580	cmd.exe	95
PID 1580 wrote to memory of 3848	1580	cmd.exe	95
PID 1580 wrote to memory of 3848	1580	cmd.exe	95
PID 3848 wrote to memory of 4556	3848	AdminHJDGCGDBGC.exe	97
PID 3848 wrote to memory of 4556	3848	AdminHJDGCGDBGC.exe	97
PID 3848 wrote to memory of 4556	3848	AdminHJDGCGDBGC.exe	97
PID 3848 wrote to memory of 1168	3848	AdminHJDGCGDBGC.exe	98
PID 3848 wrote to memory of 1168	3848	AdminHJDGCGDBGC.exe	98
PID 3848 wrote to memory of 1168	3848	AdminHJDGCGDBGC.exe	98
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3848 wrote to memory of 3376	3848	AdminHJDGCGDBGC.exe	99
PID 3948 wrote to memory of 5220	3948	RegAsm.exe	100
PID 3948 wrote to memory of 5220	3948	RegAsm.exe	100
PID 3948 wrote to memory of 5220	3948	RegAsm.exe	100
PID 5220 wrote to memory of 4936	5220	cmd.exe	102
PID 5220 wrote to memory of 4936	5220	cmd.exe	102
PID 5220 wrote to memory of 4936	5220	cmd.exe	102
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105
PID 4936 wrote to memory of 3344	4936	AdminDHIDHIEGII.exe	105

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHJDGCGDBGC.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Users\AdminHJDGCGDBGC.exe
      "C:\Users\AdminHJDGCGDBGC.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4556
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1168
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDHIDHIEGII.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Users\AdminDHIDHIEGII.exe
      "C:\Users\AdminDHIDHIEGII.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BAFCFB

Path C:\ProgramData\EGDGIEGHJEGI\BAFCFB
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

IJJKKJ

Path C:\ProgramData\EGDGIEGHJEGI\IJJKKJ
Size 114KB
SHA256 c3aa800492bc1e5ff4717db8c82d1f3772b24579cde51058bdd73a9cc9822dc7
MD5 f0b6304b7b1d85d077205e5df561164a
SHA1 186d8f4596689a9a614cf47fc85f90f0b8704ffe
SHA512 d672ea182ddf56a331d3209dcf7b9af8c3ffad0b787b224fe9e3e4c80205e474a66914358fa253c170c85a8366da2f2c3aa9d42e1f6f3291a9e6bdd9ba51fb0a
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cFqLVumf:I02m/lxhlnmhouHMVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminDHIDHIEGII.exe

Path C:\Users\AdminDHIDHIEGII.exe
Size 331KB
SHA256 f8861ee76ab52271e7fe9e9b9d15d3a042d9aab97dfd078f213564c7094d3f3b
MD5 a262d309528b0bbf3f0865d55d86dc2e
SHA1 77b5788a950f19bcb6e0c653f8e31a664b618820
SHA512 e89d4954365d43f9d177cc14a348ecdbcbe049739d14f1be372287dd14002ac715761f575c456b528f190fea2d2ab83521f6bfd814763365139f66ee7153540e
SSDEEP 6144:RA09eRHXLnnEAn/ksk7MM5v/mPfsr8I6lM5WXbNsp+aS/CNO2HC6EO:RoRHoAMXL5vYfs4IGJZsUaSqNO2H3EO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminHJDGCGDBGC.exe

Path C:\Users\AdminHJDGCGDBGC.exe
Size 293KB
SHA256 9c1173238ad24a2c0f1b36e424a3e9f94c41ab757c8897e4b57b9212fb8d4fd4
MD5 b525b80d2056db699ed31d53b5955588
SHA1 6255e3315403e648658c4aa58296c4c63a998bc1
SHA512 b174315e9f6f7ce26c8285aaa0a5ca3f2b3ae4545dfdd6cb6eff3a581ad811b502e6cb4249dcd270ba6bb8deaf31d3f656242332d4eb59a48075b23a03e16ff7
SSDEEP 6144:zrOMp+74wxjRj1EOeIG9hilRRAroUuZULldYKq9HEO:+T0Aj1z74iMrorKqJEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2340-98-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/2340-7-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/2340-1-0x00000000004D0000-0x0000000000508000-memory.dmp

Download

memory/2340-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/3344-122-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3344-124-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3344-120-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3376-99-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-159-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-93-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-90-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-143-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-130-0x0000000022830000-0x0000000022A8F000-memory.dmp

Download

memory/3376-127-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-126-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-125-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-166-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3376-167-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3848-97-0x0000000072870000-0x0000000073020000-memory.dmp

Download

memory/3848-105-0x0000000072870000-0x0000000073020000-memory.dmp

Download

memory/3848-88-0x0000000000790000-0x00000000007DA000-memory.dmp

Download

memory/3848-87-0x000000007287E000-0x000000007287F000-memory.dmp

Download

memory/3948-113-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3948-109-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3948-6-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3948-3-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3948-9-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3948-8-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4936-118-0x0000000000AE0000-0x0000000000B34000-memory.dmp

Download